Suffix Tree for Blacklisted Encrypted Domain Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security devices face performance costs when intercepting and filtering Domain Name Service (DNS) requests due to the need for converting domain names to encrypted hashes and performing lookups in compliance with regulations like FedRAMP, which requires asymmetric crypto hash methods and repeated crypto operations for each label in blacklisted domain names.
Innovation Solution
The implementation of a suffix tree data structure that uses encrypted hash keys to efficiently filter blacklisted domains by generating hash key pairs for domain names, searching a hash table, and reusing previously processed information to avoid multiple crypto operations and optimize lookups, thereby reducing processing time and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If domain names are converted to encrypted hashes and lookups are performed using asymmetric crypto hash methods for each label in blacklisted domain names, then security compliance with FedRAMP is achieved, but processing time and performance are significantly reduced
Solution Approach 1:
The patent pre-computes and stores encrypted hash values for domain name labels in a suffix tree data structure during system initialization or updates. When DNS queries arrive, the system performs direct tree traversal using the pre-computed hash keys without performing crypto operations on each query, thus maintaining security compliance while dramatically improving query processing speed
Solution Approach 2:
The patent combines multiple domain name label hashes into a composite hash key that can be used to traverse the suffix tree. By merging the hash computation results for multiple labels into a single traversal operation, the system reduces the number of separate lookup operations required while maintaining the security requirements of FedRAMP compliance
2Measurement precision
If multiple crypto operations are performed for each label in domain names during DNS query processing, then accurate blacklisted domain detection is achieved, but processing overhead and latency increase
Solution Approach 1:
The system pre-computes encrypted hash values for all domain name labels and stores them in the suffix tree structure. During DNS query processing, it performs a single tree traversal operation using these pre-computed hashes instead of performing multiple crypto operations on each query, thereby maintaining detection accuracy while significantly reducing processing latency
Solution Approach 2:
The patent creates a copy of the domain name label hash values in the suffix tree data structure during system setup. This allows the system to reference the copied hash values during query processing without performing repeated crypto operations, maintaining accurate blacklisted domain detection while reducing time loss
Data Source
AI summary
In accordance with an embodiment, described herein are systems and methods for use of a suffix tree to control blocking of blacklisted encrypted domains. A suffix tree includes encrypted hash keys corresponding to a plurality of domain nodes. A domain-related request packet is received, and a target domain name extracted from the packet. A pair of hash keys are generated for the request packet and target domain; and a hash table is searched with the generated hash key pair. If a corresponding entry is found in the hash table, then a corresponding hash suffix pointer is determined for the packet, and the suffix tree examined to determine whether the node identified by the query is part of a blacklisted node. If the suffix tree indicates the node to be part of a blacklisted node, then the system can perform a specified action associated with that node.